Remote Code Execution:
There is a very serious, easy to exploit remote code execution issue in the phpRPC library.
This issue takes place in the file rpc_decoder.php within the decode() function.
This function is
basically responsible for decoding the incoming XML data into php readable data that can be used by the application.
Alle Details und Informationen vom GulfTech Security Research Team:
phpRPC Library Remote Code Execution
Weitere Schwachstelle in phpRPC gefunden
So eben ist über eine Securitymailingliste eine weitere Schwachstelle phpRPC publiziert worden.
Description:
phpRPC is meant to be an easy to use xmlrpc library. phpRPC is greatly simplified with the use of database/rpc-protocol abstraction. It should run on any php server with most data
bases. Unfortunately, there is a easily exploitable remote php code execution vulnerability in the phpRPC library that allows an attacker to execute arbitrary code on the affected webserver.
This vulnerability, like previously discovered vulnerabilities in various implementations of the XMLRPC protocol is possible because of unsanitized data being passed to an eval call.
This of course could ultimately lead to a compromise of the under lying web server, and disclosure of sensitive data.